{"record":{"id":"0bd70b794df0eed9","repo":"googleapis/mcp-toolbox","slug":"error-creating-client-from-oauth-access-token-w","errorCode":null,"errorMessage":"error creating client from OAuth access token: %w","messagePattern":"error creating client from OAuth access token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/bigquery/bigquery.go","lineNumber":601,"sourceCode":"\t\t\t}\n\t\t})\n\t\treturn client, clientCreator, err\n\t}\n}\n\nfunc (s *Source) RetrieveClientAndService(accessToken tools.AccessToken) (*bigqueryapi.Client, *bigqueryrestapi.Service, error) {\n\tbqClient := s.BigQueryClient()\n\trestService := s.BigQueryRestService()\n\n\t// Initialize new client if using user OAuth token\n\tif s.UseClientAuthorization() {\n\t\ttokenStr, err := accessToken.ParseBearerToken()\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"error parsing access token: %w\", err)\n\t\t}\n\t\tbqClient, restService, err = s.BigQueryClientCreator()(tokenStr, true)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"error creating client from OAuth access token: %w\", err)\n\t\t}\n\t}\n\treturn bqClient, restService, nil\n}\n\nfunc (s *Source) RunSQL(ctx context.Context, bqClient *bigqueryapi.Client, statement, statementType string, params []bigqueryapi.QueryParameter, connProps []*bigqueryapi.ConnectionProperty, labels map[string]string) (any, error) {\n\tquery := bqClient.Query(statement)\n\tquery.Location = bqClient.Location\n\tif params != nil {\n\t\tquery.Parameters = params\n\t}\n\tif connProps != nil {\n\t\tquery.ConnectionProperties = connProps\n\t}\n\tif labels != nil {\n\t\tquery.Labels = labels\n\t}\n\tif s.MaximumBytesBilled > 0 {","sourceCodeStart":583,"sourceCodeEnd":619,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/bigquery/bigquery.go#L583-L619","documentation":"Raised when the bearer token parsed from the request is valid syntactically, but constructing the BigQuery client (and REST service) with that user token fails. The client creator exchanges/validates the token against Google APIs, so failures reflect credential rejection or API client construction errors.","triggerScenarios":"Source has UseClientAuthorization enabled; ParseBearerToken succeeded, then BigQueryClientCreator()(tokenStr, true) fails — e.g. the token is expired or revoked, lacks bigquery scopes, the project is invalid, or options like impersonation cannot be applied with the user token.","commonSituations":"Expired/revoked user OAuth token, token issued without cloud-platform or bigquery scope, wrong project ID in source config, or disabled BigQuery API in the project.","solutions":["Refresh the OAuth token and retry with a fresh access token","Ensure the OAuth consent/scopes include https://www.googleapis.com/auth/bigquery (or cloud-platform)","Verify the source's project ID is correct and the BigQuery API is enabled","If using impersonation with user tokens, confirm the account can impersonate the target service account (roles/iam.serviceAccountTokenCreator)"],"exampleFix":"// before\nclient := oauth2.Client(ctx, expiredToken)\n// after\ntokenSrc := expiredToken.TokenSource(ctx)\nfresh, _ := tokenSrc.Token()\nclient := oauth2.NewClient(ctx, oauth2.ReuseTokenSource(fresh, tokenSrc))","handlingStrategy":"try-catch","validationCode":"if time.Now().After(token.Expiry.Add(-1 * time.Minute)) {\n    return errors.New(\"access token expired; refresh before calling the tool\")\n}","typeGuard":null,"tryCatchPattern":"client, svc, err := src.RetrieveClientAndService(accessToken)\nif err != nil && strings.Contains(err.Error(), \"error creating client from OAuth access token\") {\n    // likely expired/insufficient-scope token: refresh and retry once\n    newTok, rerr := refresh(ctx)\n    if rerr != nil { return rerr }\n    client, svc, err = src.RetrieveClientAndService(newTok)\n    return err\n}","preventionTips":["Request bigquery (or cloud-platform) scope in the OAuth consent flow","Reuse an auto-refreshing TokenSource instead of static tokens","Keep project IDs and enabled APIs verified in source config","Log and surface the wrapped googleapi error code for faster triage"],"tags":["oauth","authentication","bigquery","client-initialization"],"backgroundTag":"oauth-token-rejected","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}